3 ms·
NPM should fix this mess. Adding postinstall should require approval from NPM. NPM clients should not install freshly published packages. NPM packages should
by Chyzwar 6mo ago
NPM should fix this mess.
Adding postinstall should require approval from NPM.
NPM clients should not install freshly published packages.
NPM packages should be scanned after publishing.
High profile packages should verify upstream git hash signature.
NPM install should run in sandbox and detect any attempt to install outside project directory.
But npm being part of multi trillion company cannot be bothered to fix any of these. Instead they push for tighter integration with GitHub with UX that suck.
- cromka 6mo ago> NPM clients should not install freshly published packages. That would be a beautiful example of Cobra effect: what about updates that fix vulnerabilities? You're gonna force users to wait couple days or a week before they can get malware removed?
- Chyzwar 6mo agoThis could be controlled by npm. Client ask for available versions anyway. If package is security fix then it can be made available instantly. But this delay gives time for security scanners and time to notify maintainers that package was published.
- mcintyre1994 6mo agoThen the malicious packages would always be published as a security fix.
- mcintyre1994 6mo agoIn cases like this that isn’t an issue, NPM takes the malicious package down and you roll back to the previous version. The problem would be new versions that fix security issues though, and because this is all open source as soon as you publish the fix everyone knows the vulnerability. You wouldn’t want everyone to stay on the insecure version with a basically public vulnerability for a week.
- cromka 6mo agoPrecisely my point.
- mememememememo 6mo agoJust ban postinstall.